CVE-2023-30607 icingaweb2-module-jira template and field configuration are susceptible to CSRF
Attackers can force deletion of Jira template and field configurations in Icinga Web 2 without user consent due to missing CSRF validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-30607?
CVE-2023-30607 is a medium-severity vulnerability in icingaweb2-module-jira, published on 5 Jul 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field configuration forms perform the deletion action before user input is validated, including the cross site request forgery token. This issue is fixed in version 1.3.2. There are no known workarounds.
Weakness: CWE-352
Which versions are affected by CVE-2023-30607?
It affects 1 product.
Products include Icinga Icinga Web Jira Integration.
How do I fix CVE-2023-30607?
No fix has been published for CVE-2023-30607 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-30607 being exploited?
There is no known exploitation of CVE-2023-30607 in the wild and no public exploit code.
Sources
Also known as GHSA-gh7w-7f7j-gwp5.